I appreciate the constructive feedback here. I'm happy to make whatever edits the community finds most useful (or have the question deleted). Let me describe more precisely the situation, what I misunderstood, and how I resolved it to the best of my current understanding.
This is a Windows Server 2012 R2 Standard server acting as a domain controller (the only domain controller) for a small domain. I took over management of this domain. I was using an account named Administrator with local login name "acmeadmin"* to login to the server. I believed that this was the builtin administrator account, the one in ACME\Users with description "Built-in account for administering the computer/domain". I mistakenly thought the "User logon name" on the account tab of this account had been changed to "acmeadmin" and that this was the account I had been using to administer the server. The logon name for this account was actually "Administrator" but the account was disabled. In reality, there was another account in ACME\MyBusiness\Users\SBSUsers (this server had been upgraded from SBS) also named "Administrator" but with user logon name "acmeadmin". This was the account I was using to administer the server. Both accounts belonged to ACME/Users/Domain Admins and originally both accounts also belonged to ACME/Builtn/Administrators
I discovered a group policy (using "Restrict Groups") that was granting membership in "Builtin/Administrators" group to all users. This group policy was probably intended to make all users local administrators on their workstations--but because of the scope of the group policy, it was also making all users members of the "Builtin/Administrators" group on the server as well. Alarmed, I set out to correct this problem. But instead of changing the scope of the policy so that it affected workstations and not the server, I just removed "Builtin/Administrators" from the restrict groups group policy. As result the account I had been using to administer the server lost it's membership in "Builtin/Administrators" on the server.
As a consequence of this, it also lost the Allow Local Logon right on the server--as this was granted to members of Builtin/Administrators.
I could no longer logon to the server locally with the acmeadmin account (as only administrators are allowed to logon to the server). I was still able to logon to workstations with the acmelogin account as non administrators had the right to logon to workstations.
The default administrator account (ACME/Users) can not lose membership in the Builtin/Administrators group (You get a "cannot perform this action on built in accounts"). I was confused because I thought this was the account I was using when really it was not.
Once I realized my mistake, I was able to boot the server and enable to the builtin Administrator account ACME/Users (I can't remember if I used DSRM or a Linux boot disk). I may have had to reset the password on the built in administrator account too--I can't recall.
Once the builtin administrator account (ACME/Users) was re-enabled, I was able to use it to access the server again and to cleanup my group policy and account problems. I hope this clarifies the situation. Please let me know how we'd like to proceed or if I should add this explanation to the self answer.
NOTE: ACME was not the real domain name
